Method and system for authorizing an operating action sent from a first field device to a second field device

Abstract

The invention comprises a method for authorizing an operating action sent from a first field device (FG1) to a second field device (FG2), wherein the first field device (FG1) comprises at least a first subcomponent (SK1), wherein the first subcomponent (SK1) is configured to enable the first field device (FG1) to execute at least one additional functionality, wherein the first subcomponent (SK1) has a first security element (SE1), wherein a first logic element (LE1) is stored in the first security element (SE1), wherein the second field device (FG2) is in communication connection with the first field device (FG1) via a communication network (KN) and comprises at least a second subcomponent (SK2), wherein the second subcomponent (SK2) is configured to enable the second field device (FG2) to execute at least one additional functionality, and wherein the second subcomponent (SK2) has a second security element (SE2).wherein a second logic element (LE2) is stored in the second security element (SE2), comprising: , - Initiating an operating action by an operator at the first field device (FG1), wherein the operating action concerns the second subcomponent (SK2) at the second field device (FG2); - Verification of the operator action by the second logic element (LE2); and - Authorizing the operating action in case of successful verification by the second logic element (LE2).

Description

[0001] The invention relates to a method for authorizing an operator action sent from a first field device to a second field device. Furthermore, the invention relates to a system.

[0002] Field devices used in industrial plants are already known from the state of the art. Field devices are widely used in process automation technology as well as in manufacturing automation technology. Field devices essentially refer to all devices used close to the process and that provide or process-relevant information. Field devices are used to record and / or influence process variables. Measuring devices or sensors are used to record process variables. These are used, for example, for pressure and temperature measurement, conductivity measurement, flow measurement, pH measurement, level measurement, etc. and record the corresponding process variables such as pressure, temperature, conductivity, pH value, level, flow, etc. Actuators are used to influence process variables.These include, for example, pumps or valves that can influence the flow of a fluid in a pipe or the fill level in a container. In addition to the previously mentioned measuring devices and actuators, field devices also include remote I / Os, wireless adapters, and generally devices located at the field level.

[0003] A large number of such field devices are produced and distributed by the Endress+Hauser Group.

[0004] In modern industrial plants, field devices are usually connected via communication networks such as fieldbuses (Profibus ® , Foundation ® Fieldbus, HART ® , etc.) are connected to higher-level units. These higher-level units are usually control systems (DCS) or control units, such as a PLC (programmable logic controller).

[0005] The higher-level units serve, among other things, for process control, process visualization, process monitoring, and the commissioning of field devices. The measured values ​​recorded by the field devices, especially sensors, are transmitted via the respective bus system to one (or possibly several) higher-level units. In addition, data transmission from the higher-level unit to the field devices via the bus system is also required, particularly for the configuration and parameterization of field devices and for controlling actuators.

[0006] The complexity of process automation systems is constantly increasing. More and more system components and field devices are being interconnected.

[0007] But the field devices themselves are also increasing in complexity and software options (especially ordering options / activation codes for functions). This means that field devices often consist of a multitude of subcomponents. These subcomponents are often designed as hardware modules, for example, as plug-in cards, especially for WLAN modules or IO cards, and define important, often safety-relevant information or functions of a field device. In some cases, these subcomponents even need to be modified during the process or during service.

[0008] Subcomponents can alternatively or additionally be implemented as software. Such software (e.g., heartbeat or custody transfer functionalities) can be available as an option for the field device and can be dynamically combined / recombined in the field. Upon purchase of such an option, a special activation code can be delivered. After entering the activation code in the field device, the software-based subcomponent is available.

[0009] With this increasing complexity comes an increasing risk of errors and security attacks.

[0010] Furthermore, errors can occur when switching subcomponents during the product lifecycle, especially during the installation and maintenance phase. There is no guarantee that only trained and authorized personnel can install or replace subcomponents. Furthermore, there is no information about who installed or modified a subcomponent, with what rights, and at what time, which complicates traceability and poses a security risk.

[0011] Attackers could exploit these described vulnerabilities in a variety of ways, for example, through spoofing or denial of service attacks, by injecting malware, etc. Incorrect software modules could also be ordered and activated, which could lead to inconsistencies.

[0012] Based on this problem, the invention is based on the object of presenting a method which enables subcomponents of a field device to be changed in a secure manner.

[0013] The object is achieved by a method according to claim 1 and by a system according to claim 12.

[0014] With regard to the method, it is provided that the method serves to authorize an operating action sent from a first field device to a second field device, wherein the first field device comprises at least one first subcomponent, wherein the first subcomponent is designed to enable the first field device to execute at least one additional functionality, wherein the first subcomponent has a first security element, wherein a first logic element and first identification information are stored in the first security element, wherein the second field device is in communication connection with the first field device via a communication network and comprises at least one second subcomponent, wherein the second subcomponent is designed to enable the second field device to execute at least one additional functionality, wherein the second subcomponent has a second security element,wherein a second logic element and a second identification information are stored in the second security element, comprising: - initiating an operating action by an operator on the first field device, wherein the operating action affects the second subcomponent on the second field device; - Checking the operator action by the second logic element; and - Authorize the operator action in case of successful verification by the second logic element.

[0015] The core of the method according to the invention is that for each subcomponent of a field device, an architecture in the form of a security element is provided in which the distributed authentication, authorization and authenticity of the subcomponents of the other field devices can be validated.

[0016] An advantageous embodiment of the method according to the invention provides that the second identification information contains a set of rules that defines at least one action permitted on the second module, and wherein the second security element only authorizes the operating action if the operating action originating from the first field device is defined as a permitted action in the set of rules. Otherwise, the operating action is rejected.

[0017] According to a preferred embodiment of the method, it is provided that the first field device sends the operating action as a telegram via the communication network to the second field device.

[0018] According to a preferred embodiment of the method, the second subcomponent comprises a logbook, wherein the received operator actions initiated by the first field device are recorded in the logbook. All steps, including who created which component relationship, when, and who created it, are stored in a traceable manner. Advantageously, the name of the operator and their role are also entered for each operator action.

[0019] An advantageous embodiment of the method provides that a first key system consisting of a first private key and a first public key is assigned to the first field device, wherein the first private key is stored in the first security element and wherein the first public key is stored in the second field device.

[0020] Accordingly, it can be provided that a second key system consisting of a second private key and a second public key is assigned to the second field device, wherein the second private key is stored in the second security element and wherein the second public key is stored in the first field device.

[0021] For example, the private keys can be written into the security element during production of the subcomponent.

[0022] According to an advantageous embodiment of the method, the second security element only authorizes the operating action if the first field device can authenticate itself to the second field device using the second public key. Authorization is accordingly rejected if the authenticity of the first field device or its first subcomponent is not met.

[0023] An advantageous embodiment of the method provides that a secure communication connection is established between the first field device and the second field device by means of the first key system and the second key system.

[0024] According to a preferred embodiment of the method, the operating action is one of the following: - Initial or new installation of the second subcomponent; - Changing a configuration and / or parameter value of the second subcomponent.

[0025] An advantageous embodiment of the method provides that the first subcomponent and the second subcomponent exchange their respective identification information, and operating actions can only be transmitted if the first subcomponent and the second subcomponent are compatible with each other. For this purpose, a subcomponent, for example, has a list of all compatible subcomponent types, with which the received identification information is compared.

[0026] With regard to the system, it is intended that the system shall include: - a first field device comprising at least one first subcomponent, wherein the first subcomponent is designed to enable the first field device to execute at least one additional functionality, wherein the first subcomponent has a first security element, wherein a first logic element and a first identification information item are stored in the first security element, and - a second field device which is in communication connection with the first field device via a communication network which comprises at least one second subcomponent, wherein the second subcomponent is designed to enable the second field device to execute at least one additional functionality, wherein the second subcomponent has a second security element, wherein a second logic element and second identification information are stored in the second security element, and wherein the second logic element is designed to authorize operating actions initiated by the first field device on the second subcomponent of the second field device.

[0027] The core of the system according to the invention is that for each subcomponent of a field device, an architecture in the form of a security element is provided in which the distributed authentication, authorization and authenticity of the subcomponents of the other field devices can be validated.

[0028] A subcomponent and its components (security element and the corresponding elements such as identification information, logic unit, etc.) can be designed as hardware with corresponding chipsets (containing a processor, a memory unit, etc.) or as software.

[0029] The communication network can be an automation fieldbus, such as Modbus, Profibus PA / DP, Foundation Fieldbus, etc. Alternatively, it can be a direct cable connection between the two field devices or a wireless connection.

[0030] According to a first variant of the system, the first field device is an operating unit. Such an operating unit is, in particular, an operating unit in which an FDT or FDI framework application runs. Alternatively, the operating unit can be a PC or a mobile device, in particular a smartphone or tablet.

[0031] One embodiment of this first variant provides that the second field device is an automation technology field device that has at least one sensor for detecting a physical, chemical, or biological variable of a process and / or an actuator for influencing a physical, chemical, or biological variable of a process. Alternatively, network devices such as control units, gateways, edge devices, etc. can also be considered field devices within the meaning of the present invention.

[0032] According to a second variant of the system, it is provided that the first field device and the second field device are field devices of automation technology, which each have at least one sensor for detecting a physical, chemical or biological variable of a process engineering process and / or an actuator for influencing a physical, chemical or biological variable of a process engineering process.

[0033] The invention is explained in more detail with reference to the following figure. It shows Fig. 1: an embodiment of the method according to the invention.

[0034] In Fig.Figure 1 shows a first field device FG1. The first field device FG1 is an operator control device used to configure and / or parameterize field devices designed as sensors or actuators. Components of the first field device FG1 are referred to below as "first" components.

[0035] The first field device FG1 has a plurality of first subcomponents SK1, SK1' that provide functionalities for the first field device FG1. Subcomponents within the meaning of this invention can be configured, for example, as hardware, in particular as a plug-in card, or as software. In the present part, the first subcomponent SK1 is configured as a software component and serves to operate field devices. The further first subcomponent SK1' serves, for example, a diagnostic function of the field device FG1.

[0036] The first subcomponent SK1 comprises a first security element SE1. The first security element SE1 is a software component that has a first piece of identification information ID1 relating to the first subcomponent SK1, a first logic unit LE1, and a first key pair comprising a first private key PrK1 and a first public key PuK1.

[0037] Furthermore, a second field device FG2 is present. The second field device FG1 is a sensor device, for example, a flow or pressure measuring device. Further examples of field devices are listed in the introductory part of the description. In the following, components of the second field device FG2 are referred to as "second" components.

[0038] The second field device FG2 has several second subcomponents SK2, SK2' that provide functionalities for the second field device FG2. In this section, the first subcomponent SK1 is designed as a hardware component, accordingly has a processor and a memory unit, and provides heartbeat functionality to the second field device FG2. The further second subcomponent SK2' serves, for example, to process measured values ​​of a process engineering process collected by a sensor unit assigned to the second field device FG2.

[0039] The second subcomponent SK2 comprises a second security element SE2. The second security element SE2 is, for example, a separate chipset provided on the hardware component. The second security element SE2 has a second identification information item ID2 relating to the second subcomponent SK2, a second logic unit LE2, and a second key pair comprising a second private key PrK2 and a second public key PuK2.

[0040] The first field device FG1 is connected to the second field device FG2 via a communication network KN. The communication network KN can be an automation fieldbus, such as Modbus, Profibus PA / DP, Foundation Fieldbus, etc. Alternatively, it can be a direct cable connection between the two field devices FG1 and FG2, or a wireless connection.

[0041] Alternatively, no direct communication connection is established between the two field devices FG1, FG2, but an indirect communication connection is used, in which a data carrier, for example a USB stick or an SD card, is exchanged between the two field devices FG1, FG2, on which the data described in the following sections, which are exchanged via the direct communication connection, are located.

[0042] The first field device FG1 transmits the first public key PuK1 to the second field device FG2 via the communication network KN, with the first public key PuK1 being stored in the second security element SE2. The second field device FG2 transmits the second public key PuK2 to the first field device FG1, with the second public key PuK2 being stored in the first security element SE1. This key exchange occurs once and under supervision.

[0043] Alternatively, the two public keys PuK1 and PuK2 are transmitted by a user to the field devices FG1 and FG2. To do this, the user connects to the field devices FG1 and FG2 using a control unit, e.g., via a wireless communication connection (Bluetooth, etc.), and transmits the corresponding public keys PuK1 and PuK2.

[0044] Advantageously, the public keys PuK1, PuK2 are additionally signed, so that the respective logic units LE1, LE2, upon receipt of a public key PuK1, PuK2, can verify whether it has a valid signature and is a genuine or plausible public key. The respective logic unit LE1, LE2 of the corresponding security elements SE1, SE2 validates the authenticity of the respective subcomponent SK1, SK2, or the other security element SE1, SE2 by verifying the received public keys PuK1, PuK2 and establishes a secure communication connection between the field devices FG1, FG2 using the key systems.

[0045] In the next step, the security elements SE1, SE2 exchange the identification information ID1, ID2 of the respective subcomponents SK1, SK2 via the established secure communication connection. The respective logic units LE1, LE2 use the received identification information ID1, ID2 to check whether the two subcomponents SK1, SK2 are compatible with each other and whether the subsequent steps can be executed with this subcomponent combination.

[0046] If the two subcomponents are compatible with each other, the respective logic unit LE1, LE2 of a subcomponent SK1, SK2 can check whether operating actions of the subcomponent of the other field device FG1, FG2 can be permitted. For this to happen, the corresponding logic unit LE1, LE2 must know the operating actions of the subcomponent of the other field device FG1, FG2. This can be achieved, for example, by a safety element SE1, SE2 having a memory unit that contains various possible operating actions of defined types of subcomponents. Using the received identification information ID1, ID2 of the other subcomponent SK1, SK2, the logic unit LE1, LE2 can look up the corresponding operating actions. Alternatively, the possible operating actions are contained in the identification information ID1, ID2 as a set of rules, provided that the file size of an identification information ID1, ID2 is sufficiently large.

[0047] In this example, the first field device FG1 is to make a parameter change in the second subcomponent SK2. After successfully establishing the secure communication connection and sending the respective identification information ID1, ID2, the field device FG1, or more precisely the subcomponent SK1, sends the corresponding operating action via the secure communication connection to the second field device FG. The second logic unit LE2 checks the operating action and authorizes it. The corresponding action is then executed by the second field device FG2, or more precisely by the second subcomponent SK2. If the second logic unit LE2 does not authorize the operating action, it is rejected and not executed.

[0048] It can be provided that the safety elements SE1, SE2 each have a storage unit that serves as a logbook. All operating actions received by a subcomponent SK1, SK2 are stored in a logbook. This allows all steps and operating actions to be traced. It can also be provided that the corresponding user who initiated the operating action and their role are stored in the logbook.

[0049] The method according to the invention can also be implemented with more than two field devices or with more than one compatible subcomponent per field device. For this purpose, each subcomponent receives the public keys and identification information of all compatible subcomponents accessible via the communication network. In such a configuration, it is also possible for a logic unit of a subcomponent to check operating actions that are not directed at its own subcomponent and trigger an alarm message if the operating action is not permitted (either because the sending subcomponent is not permitted to send such an operating action, or because the receiving subcomponent is not permitted to receive such an operating action). List of reference symbols FG1 first field device FG2 second field device ID1 first identification information ID2 second identification information KN Communication Network LE1 first logic element LE2 second logic element PrK1 first private key PrK2 second private key PuK1 first public key PuK2 second public key SE1 first security element SE2 second security element SK1 first subcomponent SK2 second subcomponent SK1', SK2' further subcomponents

Claims

[1] Method for authorizing an operating action sent from a first field device (FG1) to a second field device (FG2), wherein the first field device (FG1) comprises at least one first subcomponent (SK1), wherein the first subcomponent (SK1) is designed to enable the first field device (FG1) to execute at least one additional functionality, wherein the first subcomponent (SK1) has a first security element (SE1), wherein a first logic element (LE1) and first identification information (ID1) are stored in the first security element (SE1), wherein the second field device (FG2) is in communication with the first field device (FG1) via a communication network (KN) and comprises at least one second subcomponent (SK2), wherein the second subcomponent (SK2) is designed to enable the second field device (FG2) to execute at least one additional functionality,wherein the second subcomponent (SK2) has a second security element (SE2), wherein a second logic element (LE2) and a second identification information (ID2) are stored in the second security element (SE2), comprising: - initiating an operating action by an operator on the first field device (FG1), wherein the operating action relates to the second subcomponent (SK2) on the second field device (FG2); - Checking the operating action by the second logic element (LE2); and - Authorizing the operating action in case of successful verification by the second logic element (LE2). [2] Method according to claim 1, wherein the second identification information (ID2) contains a set of rules which defines at least one action permitted on the second module, and wherein the second security element (SE2) authorises the operating action only if the operating action originating from the first field device (FG1) is defined in the set of rules as a permitted action. [3] Method according to claim 2, wherein the first field device (FG1) sends the operating action as a telegram via the communication network (KN) to the second field device (FG2). [4] Method according to one of the preceding claims, wherein the second subcomponent (SK2) comprises a logbook, wherein the received operating actions initiated by the first field device (FG1) are entered in the logbook. [5] Method according to claim 4, wherein a name of the operator and his role are additionally entered for each operating action. [6] Method according to one of the preceding claims, wherein the first field device (FG1) is assigned a first key system consisting of a first private key and a first public key, wherein the first private key is stored in the first security element (SE1) and wherein the first public key is stored in the second field device (FG2). [7] Method according to one of the preceding claims, wherein a second key system consisting of a second private key and a second public key is assigned to the second field device (FG2), wherein the second private key is stored in the second security element (SE2) and wherein the second public key is stored in the first field device (FG1). [8] Method according to claim 6, wherein the second security element (SE2) authorizes the operating action only if the first field device (FG1) can authenticate itself to the second field device (FG2) by means of the second public key. [9] Method according to one of claims 6 to 8, wherein a secure communication connection between the first field device (FG1) and the second field device (FG2) is established by means of the first key system and the second key system. [10] Method according to one of the preceding claims, wherein the operating action is one of the following: - First or new installation of the second subcomponent (SK2); - Changing a configuration and / or a parameter value of the second subcomponent (SK2). [11] Method according to one of the preceding claims, wherein the first subcomponent (SK1) and the second subcomponent (SK2) exchange their respective identification information (ID1, ID2) and only operating actions can be transmitted if the first subcomponent (SK1) and the second subcomponent (SK2) are compatible with each other. [12] System comprising: - a first field device (FG1) comprising at least one first subcomponent (SK1), wherein the first subcomponent (SK1) is designed to enable the first field device (FG1) to execute at least one additional functionality, wherein the first subcomponent (SK1) has a first security element (SE1), wherein a first logic element (LE1) and a first identification information item (ID1) are stored in the first security element (SE1), and - a second field device (FG2) which is in communication connection with the first field device (FG1) via a communication network (KN) which comprises at least one second subcomponent (SK2), wherein the second subcomponent (SK2) is designed to enable the second field device (FG2) to execute at least one additional functionality, wherein the second subcomponent (SK2) has a second security element (SE2), wherein a second logic element (LE2) and a second identification information item (ID2) are stored in the second security element (SE2), and wherein the second logic element (LE2) is designed to authorize operating actions initiated by the first field device (FG1) on the second subcomponent (SK2) of the second field device (FG2). [13] System according to claim 12, wherein the first field device (FG1) is an operating unit. [14] System according to claim 12 and 13, wherein the second field device (FG2) is an automation field device which has at least one sensor for detecting a physical, chemical or biological variable of a process engineering process and / or an actuator for influencing a physical, chemical or biological variable of a process engineering process. [15] System according to claim 12, wherein the first field device (FG1) and the second field device (FG2) are field devices of automation technology, each having at least one sensor for detecting a physical, chemical or biological variable of a process engineering process and / or an actuator for influencing a physical, chemical or biological variable of a process engineering process.

Images